CVE-2026-4975: Tenda AC15 Buffer Overflow Vulnerability

CVE-2026-4975 Overview

CVE-2026-4975 is a stack-based buffer overflow in the Tenda AC15 router running firmware version 15.03.05.19. The flaw resides in the formSetCfm function within the /goform/setcfm endpoint of the device's POST request handler. Manipulating the funcpara1 argument overflows a fixed-size stack buffer, corrupting adjacent memory and the saved return address. Attackers can trigger the condition remotely over the network. The exploit details have been disclosed publicly, raising the likelihood of weaponization against exposed devices. The vulnerability maps to [CWE-119] and [CWE-787], reflecting both improper restriction of operations within memory bounds and out-of-bounds write behavior.

Critical Impact

Successful exploitation enables remote attackers to corrupt stack memory on the router, potentially leading to arbitrary code execution and full device compromise.

Affected Products

• Tenda AC15 router (hardware revision 1.0)
• Tenda AC15 firmware version 15.03.05.19_multi
• Deployments exposing the /goform/setcfm endpoint to untrusted networks

Discovery Timeline

• 2026-03-27 - CVE-2026-4975 published to the National Vulnerability Database (NVD)
• 2026-04-03 - Last updated in NVD database

Technical Details for CVE-2026-4975

Vulnerability Analysis

The Tenda AC15 web management interface exposes the /goform/setcfm handler, which dispatches incoming POST requests to the formSetCfm function. The handler reads the funcpara1 parameter from the request body and copies it into a fixed-size stack buffer without validating the input length. Attackers supplying an overlong funcpara1 value overflow the destination buffer and overwrite saved registers and the return address on the stack. Because the device runs services with elevated privileges and lacks modern mitigations such as full ASLR and stack canaries on many MIPS-based consumer routers, the corruption frequently translates into reliable control of execution flow. The attacker requires only network reachability to the management interface and a low-privilege session to trigger the condition.

Root Cause

The root cause is missing bounds checking on attacker-controlled input before a stack copy operation in formSetCfm. The firmware trusts the length of the funcpara1 POST parameter and writes it into a stack buffer using an unsafe string copy routine. This pattern is a textbook [CWE-787] out-of-bounds write paired with [CWE-119] improper memory boundary enforcement.

Attack Vector

An attacker sends a crafted HTTP POST request to /goform/setcfm containing an oversized funcpara1 parameter. If the router's web interface is reachable from the local network, or worse, exposed to the internet through port forwarding or remote management features, the request reaches formSetCfm and overflows the stack. The publicly disclosed proof of concept lowers the barrier to exploitation considerably. Refer to the Notion Security Report and VulDB entry 353862 for the disclosed technical details.

Detection Methods for CVE-2026-4975

Indicators of Compromise

• HTTP POST requests to /goform/setcfm containing abnormally long funcpara1 values, typically several hundred bytes or more
• Unexpected reboots, crashes, or httpd process restarts on Tenda AC15 devices following inbound web traffic
• Outbound connections from the router to unfamiliar hosts shortly after suspicious POST traffic

Detection Strategies

• Inspect web access logs and network captures for POST requests to /goform/setcfm with funcpara1 payload lengths that exceed normal administrative usage
• Deploy IDS or IPS signatures that flag oversized parameter values in HTTP request bodies targeting Tenda management endpoints
• Correlate router crash events with preceding HTTP traffic to identify exploitation attempts that produce denial-of-service side effects

Monitoring Recommendations

• Forward router syslog and management-plane logs to a centralized analytics platform for length-based and frequency-based anomaly detection
• Track WAN-side access attempts to the device's HTTP management interface and alert on any unexpected exposure
• Baseline normal administrative POST sizes against /goform/ endpoints so deviations stand out

How to Mitigate CVE-2026-4975

Immediate Actions Required

• Disable remote (WAN-side) web management on affected Tenda AC15 devices until a fix is verified
• Restrict LAN-side access to the management interface to a dedicated administrative VLAN or trusted host list
• Replace end-of-life Tenda AC15 hardware where vendor patches are not forthcoming

Patch Information

No vendor advisory or patched firmware build has been published in the referenced sources at the time of the NVD entry. Monitor the Tenda official website and the VulDB CTI record for updates. Apply any vendor-released firmware update for Tenda AC15 once it becomes available and validates against the formSetCfm overflow.

Workarounds

• Block external access to TCP ports used by the router's HTTP management service at the perimeter firewall
• Require VPN access for any remote administration of the device rather than exposing the web UI directly
• Place vulnerable routers behind a segmenting firewall that drops HTTP requests with oversized POST parameters to /goform/setcfm

# Example: restrict router management to a single admin host on the LAN
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP